Windows Event ID 5145 — A network share object was checked to see whether client can be granted desired access — SecOps Tools

Why event 5145 matters

Mass file access within shares — ransomware accessing thousands of files in rapid succession. Specific sensitive file access (passwords.txt, .env, web.config). DLP monitoring of share file access.

How to detect it

Very high volume — alert only on specific ObjectName patterns (credential files, config files). Alert: >1000 different files accessed by single user within 1 min (ransomware pattern).

Log source

Security

Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).

Fields to pivot on

ShareNameRelativeTargetNameIpAddressSubjectUserNameAccessMask

MITRE ATT&CK mapping

Tactic	Technique
Collection	Data from Network Shared Drive (T1039)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 5145   // A network share object was checked to see whether client can be granted desired access
| project TimeGenerated, Computer, ShareName, RelativeTargetName, IpAddress, SubjectUserName, AccessMask
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=5145
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A network share object was checked to see whether client can be granted desired access — add EventData fields: ShareName, RelativeTargetName, IpAddress, SubjectUserName`

Hunt event 5145 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Object Access events

4656 A handle to an object was requested 4657 A registry value was modified 4658 The handle to an object was closed 4660 An object was deleted 4663 An attempt was made to access an object 4665 An attempt was made to create an application client context 4670 Permissions on an object were changed 4690 An attempt was made to duplicate a handle to an object 4985 The state of a transaction has changed 5140 A network share object was accessed 5142 A network share object was added 5143 A network share object was modified

Frequently asked questions

What is Windows Event ID 5145?

A network share object was checked to see whether client can be granted desired access. Granular network share access check. Includes the specific file/directory accessed within the share. Higher volume than 5140.

Which log records event 5145?

Event 5145 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 5145?

Event 5145 is associated with: Data from Network Shared Drive (T1039).

How do you detect activity around event 5145?

Very high volume — alert only on specific ObjectName patterns (credential files, config files). Alert: >1000 different files accessed by single user within 1 min (ransomware pattern).